picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

execute: add helper for checking if root_directory/root_image are set in ExecContext

Browse source
This commit is contained in:
Lennart Poettering 2020-10-01 10:42:10 +02:00
parent 36296ae2ad
commit 74e1252072
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/core/execute.c
View file

@ -2983,7 +2983,7 @@ static int compile_bind_mounts(
continue; continue;
if (exec_directory_is_private(context, t) && if (exec_directory_is_private(context, t) &&
!(context->root_directory || context->root_image)) { !exec_context_with_rootfs(context)) {
char *private_root; char *private_root;
/* So this is for a dynamic user, and we need to make sure the process can access its own /* So this is for a dynamic user, and we need to make sure the process can access its own
@ -3014,7 +3014,7 @@ static int compile_bind_mounts(
} }
if (exec_directory_is_private(context, t) && if (exec_directory_is_private(context, t) &&
(context->root_directory || context->root_image)) exec_context_with_rootfs(context))
/* When RootDirectory= or RootImage= are set, then the symbolic link to the private /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
* directory is not created on the root directory. So, let's bind-mount the directory * directory is not created on the root directory. So, let's bind-mount the directory
* on the 'non-private' place. */ * on the 'non-private' place. */
@ -5658,7 +5658,7 @@ bool exec_context_get_effective_mount_apivfs(const ExecContext *c) {
return c->mount_apivfs; return c->mount_apivfs;
/* Default to "yes" if root directory or image are specified */ /* Default to "yes" if root directory or image are specified */
if (c->root_image || !empty_or_root(c->root_directory)) if (exec_context_with_rootfs(c))
return true; return true;
return false; return false;

9
src/core/execute.h
View file

@ -23,6 +23,7 @@ typedef struct Manager Manager;
#include "namespace.h" #include "namespace.h"
#include "nsflags.h" #include "nsflags.h"
#include "numa-util.h" #include "numa-util.h"
#include "path-util.h"
#include "time-util.h" #include "time-util.h"
#define EXEC_STDIN_DATA_MAX (64U*1024U*1024U) #define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
@ -325,6 +326,14 @@ static inline bool exec_context_restrict_namespaces_set(const ExecContext *c) {
return (c->restrict_namespaces & NAMESPACE_FLAGS_ALL) != NAMESPACE_FLAGS_ALL; return (c->restrict_namespaces & NAMESPACE_FLAGS_ALL) != NAMESPACE_FLAGS_ALL;
} }
static inline bool exec_context_with_rootfs(const ExecContext *c) {
assert(c);
/* Checks if RootDirectory= or RootImage= are used */
return !empty_or_root(c->root_directory) || c->root_image;
}
typedef enum ExecFlags { typedef enum ExecFlags {
EXEC_APPLY_SANDBOXING = 1 << 0, EXEC_APPLY_SANDBOXING = 1 << 0,
EXEC_APPLY_CHROOT = 1 << 1, EXEC_APPLY_CHROOT = 1 << 1,